badeef3f2c904647e2d829cd25a840d66f2ecee14f11968edc4f4bb715c4daff

Analysis

user interaction
yes
max time kernel
150s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 23:06

Target
toji_vs_gojo.rar
Size 25.8MB
Sample260823-23rhtawvbv
SHA256 badeef3f2c904647e2d829cd25a840d66f2ecee14f11968edc4f4bb715c4daff
MD5 d56ee38d4db12913b7d1d8a9fed6c9bf
SHA1 9d58f515b99f435d4c41c41852577d6eb5af5650
SHA512 3af597fcf4565b24d6be0683477d546e903561e47a0e19a3f827d0f355ce06b1c71a919d259d15ccb4d47a0a31ec16e50912cbee9c065b2c0ebcc42e15332000
SSDEEP 393216:+TngxoG30Am3sNIs4YX1Qlev5SCVJfaiFgVwH68AGfaPEDlL2BVwubhjH3qCDtFo:+Tnkf306Px5SC6UgVnL9zBVwkhLJpFo
TLSH
T19E5733933AF7E16FEC80C2F3CA7C789B636485226159352ACF6D92D2D6974C2583D930
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5428	7zFM.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	5428	7zFM.exe
Token: 35	5428	7zFM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5428	7zFM.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4888